@blamejs/blamejs-shop 0.2.14 → 0.2.17

package/lib/vendor/blamejs/test/20-db.js

@@ -456,12 +456,203 @@ async function testUnsealRowNullsForgedValue() {
   }
 }
 
+async function testEncryptedTmpfsCorruptionAutoRecovers() {
+  // Regression: in encrypted-at-rest mode the live SQLite copy lives in a
+  // tmpfs working file; a corrupt newer working copy (unclean shutdown, or
+  // a full /dev/shm — Docker's 64 MiB default) must NOT be trusted on
+  // boot. decryptToTmp's "newer plaintext wins" crash-recovery path used
+  // to keep it unconditionally, so db.init failed its integrity gate with
+  // "database disk image is malformed" identically on every boot — an
+  // unrecoverable crash loop (the blamejs.com wiki looped 4,625 times).
+  // The fix: integrity-probe the newer working copy; if bad, discard it
+  // and re-decrypt the last-good db.enc. db.enc is never modified.
+  //
+  // Scratch dir lives under the repo-local .test-output (not os.tmpdir):
+  // this test intentionally corrupts its working file in place, which
+  // static analysis (CodeQL js/insecure-temporary-file) flags as an
+  // insecure OS-temp-dir write. A gitignored per-test dir outside the
+  // shared OS temp dir sidesteps that false positive and is cleaner for
+  // test isolation besides.
+  var scratchBase = path.join(__dirname, "..", ".test-output");
+  fs.mkdirSync(scratchBase, { recursive: true });
+  var tmpDir = fs.mkdtempSync(path.join(scratchBase, "db-tmpfs-corrupt-"));
+  var schema = [{ name: "recovery_t", columns: { _id: "TEXT PRIMARY KEY", v: "TEXT" } }];
+  try {
+    await setupTestDb(tmpDir, schema);
+    check("recovery test runs in encrypted mode", b.db.getMode() === "encrypted");
+    b.db.prepare("INSERT INTO recovery_t (_id, v) VALUES (?, ?)").run("r1", "survives");
+    await b.db.flushToDisk();                       // persist to db.enc (last-good snapshot)
+    b.db._resetForTest();                            // close handle; leaves the working file on disk
+
+    // Locate the tmpfs working copy under our own scratch dir (setupTestDb
+    // points the working dir at <tmpDir>/tmpfs). Resolve it from `tmpDir`
+    // — our .test-output mkdtemp — rather than b.db.getDbPath(), so the
+    // path's non-OS-temp provenance stays visible to static analysis.
+    var workingDir = path.join(tmpDir, "tmpfs");
+    var workingFile = fs.readdirSync(workingDir).filter(function (f) { return /\.db$/.test(f); })[0];
+    var workingPath = path.join(workingDir, workingFile);
+
+    // Corrupt the existing working copy in place — overwrite the SQLite
+    // header so the file is no longer a valid database — and stamp it
+    // newer than db.enc (the exact trap shape that produced the crash
+    // loop). Open with "r+" (must already exist; never creates a file) so
+    // this is an in-place corruption of a known file.
+    var corruptFd = fs.openSync(workingPath, "r+");
+    try { fs.writeSync(corruptFd, Buffer.from("not a sqlite database -- corrupt header\n".repeat(8)), 0, undefined, 0); }
+    finally { fs.closeSync(corruptFd); }
+    var future = new Date(Date.now() + 60000);
+    fs.utimesSync(workingPath, future, future);
+
+    // Re-init against the same dataDir. Mirror setupTestDb's pre-init
+    // reset (passphrase env + audit reset) so db.init re-wires audit-sign
+    // from the same passphrase — but do NOT reset the vault, so the
+    // existing db.enc key still decrypts. The corrupt newer working copy
+    // must be discarded and db.enc re-decrypted — boot must succeed.
+    setTestPassphraseEnv();
+    b.audit._resetForTest();
+    await b.db.init({ dataDir: tmpDir, tmpDir: path.join(tmpDir, "tmpfs"), schema: schema });
+    var row = b.db.prepare("SELECT v FROM recovery_t WHERE _id = ?").get("r1");
+    check("corrupt tmpfs working copy auto-recovers from db.enc (no crash loop)",
+          row && row.v === "survives");
+  } finally {
+    try { b.db._resetForTest(); } catch (_e) { /* best effort */ }
+    await teardownTestDb(tmpDir);
+  }
+}
+
+async function testEncryptedCloseKeepsPlaintextWhenEncryptFails() {
+  // close()'s final re-encrypt can fail (full /dev/shm, disk-full). When it
+  // does, the plaintext working copy is the ONLY carrier of writes since
+  // the last periodic flush — close() must NOT unlink it (it used to do so
+  // unconditionally), so the next boot's newer-mtime recovery can pick it
+  // up. db.enc still holds the prior snapshot, so nothing is lost either
+  // way; the bug was discarding the MORE-recent state on an encrypt error.
+  var scratchBase = path.join(__dirname, "..", ".test-output");
+  fs.mkdirSync(scratchBase, { recursive: true });
+  var tmpDir = fs.mkdtempSync(path.join(scratchBase, "db-close-encfail-"));
+  var schema = [{ name: "close_t", columns: { _id: "TEXT PRIMARY KEY", v: "TEXT" } }];
+  try {
+    await setupTestDb(tmpDir, schema);
+    check("close-encfail test runs in encrypted mode", b.db.getMode() === "encrypted");
+    b.db.prepare("INSERT INTO close_t (_id, v) VALUES (?, ?)").run("c1", "kept");
+    await b.db.flushToDisk();   // db.enc now holds the prior snapshot
+
+    var workingDir = path.join(tmpDir, "tmpfs");
+    var workingFile = fs.readdirSync(workingDir).filter(function (f) { return /\.db$/.test(f); })[0];
+    var workingPath = path.join(workingDir, workingFile);
+    check("working copy exists before close", fs.existsSync(workingPath));
+
+    // Force the final encrypt to throw: replace db.enc with a directory so
+    // atomicFile's rename-into-place fails (portable across platforms).
+    var encPath = path.join(tmpDir, "db.enc");
+    fs.rmSync(encPath, { force: true });
+    fs.mkdirSync(encPath);
+
+    // The real close() (the appShutdown db-phase path), not _resetForTest.
+    b.db.close();
+
+    check("encrypt-failed close keeps the plaintext working copy for recovery",
+          fs.existsSync(workingPath));
+  } finally {
+    try { b.db._resetForTest(); } catch (_e) { /* best effort */ }
+    await teardownTestDb(tmpDir);
+  }
+}
+
+async function testTmpfsLowSpaceRefusesWritesFailClear() {
+  // When the encrypted-mode tmpfs working copy runs low on free space, the
+  // DB must REFUSE growth writes (INSERT/UPDATE/REPLACE) with a clear error
+  // instead of proceeding into an ENOSPC corruption. DELETE + reads stay
+  // available so retention can reclaim space and the app keeps serving. An
+  // injected statfs reader drives the probe deterministically.
+  var BYTES = b.constants.BYTES;
+  var scratchBase = path.join(__dirname, "..", ".test-output");
+  fs.mkdirSync(scratchBase, { recursive: true });
+  var tmpDir = fs.mkdtempSync(path.join(scratchBase, "db-lowspace-"));
+  var schema = [{ name: "space_t", columns: { _id: "TEXT PRIMARY KEY", v: "TEXT" } }];
+  var fakeFree = BYTES.mib(100);                       // start healthy
+  var fakeStatfs = function () { return { bavail: fakeFree, bsize: 1 }; };
+  try {
+    process.env.BLAMEJS_SKIP_NTP_CHECK = "1";
+    setTestPassphraseEnv();
+    b.cluster._resetForTest();
+    b.audit._resetForTest();
+    b.vault._resetForTest();
+    b.db._resetForTest();
+    await b.vault.init({ dataDir: tmpDir });
+    await b.db.init({
+      dataDir: tmpDir, tmpDir: path.join(tmpDir, "tmpfs"), schema: schema,
+      minFreeBytes: BYTES.mib(16), _statfsForTest: fakeStatfs,
+    });
+    check("low-space test runs in encrypted mode", b.db.getMode() === "encrypted");
+
+    b.db.prepare("INSERT INTO space_t (_id, v) VALUES (?, ?)").run("a", "1");
+    check("healthy free space → INSERT succeeds",
+          b.db.prepare("SELECT v FROM space_t WHERE _id = ?").get("a").v === "1");
+
+    // Drop below the threshold and force a probe.
+    fakeFree = BYTES.mib(1);
+    var st = b.db._probeStorageForTest();
+    check("low free space flips writesRefused",       st.writesRefused === true);
+
+    var threw = null;
+    try { b.db.prepare("INSERT INTO space_t (_id, v) VALUES (?, ?)").run("bb", "2"); }
+    catch (e) { threw = e; }
+    check("low space → INSERT throws db/storage-low (fail-clear, not corruption)",
+          threw && threw.code === "db/storage-low");
+
+    // DELETE + reads must still work — the retention escape valve + serving.
+    var delThrew = null;
+    try { b.db.prepare("DELETE FROM space_t WHERE _id = ?").run("a"); } catch (e) { delThrew = e; }
+    check("low space → DELETE still allowed",          delThrew === null);
+    check("low space → reads still allowed",
+          b.db.prepare("SELECT COUNT(*) AS n FROM space_t").get().n === 0);
+
+    // Recover: free space returns → flag clears → growth writes resume.
+    fakeFree = BYTES.mib(100);
+    var st2 = b.db._probeStorageForTest();
+    check("recovered free space clears writesRefused", st2.writesRefused === false);
+    var okErr = null;
+    try { b.db.prepare("INSERT INTO space_t (_id, v) VALUES (?, ?)").run("cc", "3"); }
+    catch (e) { okErr = e; }
+    check("recovered → INSERT succeeds again",         okErr === null);
+  } finally {
+    try { b.db._resetForTest(); } catch (_e) { /* best effort */ }
+    await teardownTestDb(tmpDir);
+  }
+}
+
+async function testExitHandlerRegisteredOnce() {
+  // The process-exit final-flush handler must register ONCE for the process
+  // lifetime, not on every init(). Re-registering per init leaked an 'exit'
+  // listener on each init/close cycle (MaxListenersExceeded under long runs).
+  var scratchBase = path.join(__dirname, "..", ".test-output");
+  fs.mkdirSync(scratchBase, { recursive: true });
+  var schema = [{ name: "el_t", columns: { _id: "TEXT PRIMARY KEY" } }];
+  var before = process.listenerCount("exit");
+  for (var i = 0; i < 3; i++) {
+    var tmpDir = fs.mkdtempSync(path.join(scratchBase, "db-exit-listener-"));
+    try {
+      await setupTestDb(tmpDir, schema);
+      b.db._resetForTest();
+    } finally {
+      await teardownTestDb(tmpDir);
+    }
+  }
+  var added = process.listenerCount("exit") - before;
+  check("exit handler registered once across init/close cycles (no listener leak)", added <= 1);
+}
+
 // ---- run() ----
 
 async function run() {
   // db basic
   await testDbBasic();
   await testUnsealRowNullsForgedValue();
+  await testEncryptedTmpfsCorruptionAutoRecovers();
+  await testEncryptedCloseKeepsPlaintextWhenEncryptFails();
+  await testTmpfsLowSpaceRefusesWritesFailClear();
+  await testExitHandlerRegisteredOnce();
   await testDbWriteOps();
   await testDbSealedWithoutDerived();
   await testDbTransactions();

package/lib/vendor/blamejs/test/layer-0-primitives/agent-idempotency.test.js

@@ -38,6 +38,25 @@ async function testBasicGetPut() {
   check("hit2 replayCount = 2",    hit2 && hit2.replayCount === 2);
 }
 
+async function testInMemoryBackendBounded() {
+  // The default in-memory backend caps its entry count so a flood of
+  // distinct idempotency keys can't grow it without bound (OOM). Eviction
+  // is oldest-first — a dropped record just means that one key re-executes
+  // on retry, never a crash. Operators needing a hard guarantee at scale
+  // supply a durable opts.store.
+  var idem = b.agent.idempotency.create({ maxInMemoryEntries: 3 });
+  await idem.put("m", "u", "k1", { n: 1 });
+  await idem.put("m", "u", "k2", { n: 2 });
+  await idem.put("m", "u", "k3", { n: 3 });
+  check("at cap: oldest still present",  (await idem.get("m", "u", "k1")) !== null);
+  // 4th distinct key pushes past the cap → evicts the oldest (k1).
+  await idem.put("m", "u", "k4", { n: 4 });
+  check("over cap: newest key retained", (await idem.get("m", "u", "k4")) !== null);
+  check("over cap: oldest key evicted",  (await idem.get("m", "u", "k1")) === null);
+  check("over cap: middle keys retained",
+        (await idem.get("m", "u", "k2")) !== null && (await idem.get("m", "u", "k3")) !== null);
+}
+
 async function testCrossActorIsolation() {
   var idem = b.agent.idempotency.create({});
   await idem.put("move", "u1", "shared-key", { changed: 1 });
@@ -275,6 +294,7 @@ async function run() {
   testSurface();
   await testAtRestSealingWithVault();
   await testBasicGetPut();
+  await testInMemoryBackendBounded();
   await testCrossActorIsolation();
   await testCrossMethodIsolation();
   await testKeyReuseDifferentArgs();

package/lib/vendor/blamejs/test/layer-0-primitives/agent-orchestrator.test.js

@@ -66,6 +66,38 @@ async function testList() {
   check("list filter tenant",           aOnly.length === 2);
 }
 
+async function testTenantScopeRegistryReads() {
+  // With tenantScope on, registry reads are scoped to the actor's tenant:
+  // an actor can't enumerate or acquire a handle to another tenant's agent
+  // (the leak agent-event-bus already prevented; orchestrator now mirrors).
+  var perms = {
+    check: function (actor, scope) {
+      // cross-tenant-admin only for actor "admin"; everyone may read.
+      if (scope === "framework-cross-tenant-admin") return !!(actor && actor.id === "admin");
+      return true;
+    },
+  };
+  var orch = b.agent.orchestrator.create({ tenantScope: true, permissions: perms });
+  var registrar = { id: "registrar", scopes: ["agent-registry:write"] };
+  await orch.register("ta.mail", _fakeAgent("a"), { agentKind: "mail", tenantId: "a", actor: registrar });
+  await orch.register("tb.mail", _fakeAgent("b"), { agentKind: "mail", tenantId: "b", actor: registrar });
+
+  var actorA = { id: "ua", tenantId: "a", scopes: ["agent-registry:read"] };
+  var listA = await orch.list({ actor: actorA });
+  check("tenant-scope list: actor sees only own-tenant agents",
+        listA.length === 1 && listA[0].tenantId === "a");
+  var ownLook = await orch.lookup("ta.mail", { actor: actorA });
+  check("tenant-scope lookup: own-tenant agent resolves", ownLook && typeof ownLook === "object");
+  var crossLook = await orch.lookup("tb.mail", { actor: actorA });
+  check("tenant-scope lookup: cross-tenant agent refused (null)", crossLook === null);
+
+  var admin = { id: "admin", tenantId: "ops", scopes: ["agent-registry:read", "framework-cross-tenant-admin"] };
+  var listAdmin = await orch.list({ actor: admin });
+  check("tenant-scope list: cross-tenant-admin sees all", listAdmin.length === 2);
+  var adminCross = await orch.lookup("ta.mail", { actor: admin });
+  check("tenant-scope lookup: cross-tenant-admin resolves any tenant", adminCross && typeof adminCross === "object");
+}
+
 async function testGuardRefusals() {
   var orch = b.agent.orchestrator.create({});
   await expectRejection("register refuses bad name",
@@ -401,6 +433,7 @@ async function run() {
   testSurface();
   await testRegisterLookupUnregister();
   await testList();
+  await testTenantScopeRegistryReads();
   await testGuardRefusals();
   await testElect();
   await testElectCluster();

package/lib/vendor/blamejs/test/layer-0-primitives/api-encrypt.test.js

@@ -90,6 +90,40 @@ async function testNonceStoreMemoryPurge() {
   store.close();
 }
 
+async function testNonceStoreMemoryCapacityFailsClosed() {
+  // A replay-protection store must bound its memory against a nonce flood,
+  // but must NOT evict a LIVE nonce to admit a new one — that reopens a
+  // replay window for the evicted nonce. So at capacity it fails CLOSED:
+  // the new (un-recordable) request is refused, not admitted unprotected.
+  var store = b.nonceStore.create({ backend: "memory", maxEntries: 3 });
+  var future = Date.now() + 60_000;
+  check("cap: first 3 live nonces admitted",
+        (await store.checkAndInsert("n1", future)) === true &&
+        (await store.checkAndInsert("n2", future)) === true &&
+        (await store.checkAndInsert("n3", future)) === true);
+  check("cap: store holds exactly maxEntries",   store._size() === 3);
+  // 4th distinct LIVE nonce — store is full of live entries, so fail closed.
+  check("cap: 4th live nonce fails closed (refused)",
+        (await store.checkAndInsert("n4", future)) === false);
+  check("cap: refused nonce was NOT stored",     store._size() === 3 && !(store._size() > 3));
+  check("cap: capacity rejection counted",       store._capacityRejects() >= 1);
+  // A previously-seen live nonce still reports as replay (not capacity).
+  check("cap: existing nonce still detected as replay",
+        (await store.checkAndInsert("n1", future)) === false);
+  store.close();
+
+  // When the ceiling is hit but EXPIRED entries exist, the inline purge
+  // reclaims room so a legitimate new nonce is admitted (not falsely
+  // refused). Fill with expired nonces, then a fresh one must succeed.
+  var store2 = b.nonceStore.create({ backend: "memory", maxEntries: 2 });
+  var past = Date.now() - 1000;
+  await store2.checkAndInsert("old1", past);
+  await store2.checkAndInsert("old2", past);
+  check("cap: full of EXPIRED entries → fresh nonce admitted (purge reclaims)",
+        (await store2.checkAndInsert("freshOne", Date.now() + 60_000)) === true);
+  store2.close();
+}
+
 async function testNonceStoreClusterBasics() {
   var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-ns-"));
   try {
@@ -1030,6 +1064,7 @@ async function run() {
   await testNonceStoreMemoryBasics();
   await testNonceStoreMemoryRejectsBadInput();
   await testNonceStoreMemoryPurge();
+  await testNonceStoreMemoryCapacityFailsClosed();
   await testNonceStoreClusterBasics();
   await testNonceStoreCustomBackend();
   await testNonceStoreUnknownBackend();

package/lib/vendor/blamejs/test/layer-0-primitives/app-shutdown.test.js

@@ -275,6 +275,10 @@ async function testAppShutdownConfigValidation() {
   } catch (e) { threw = e; }
   check("create: bad-shaped phase rejected",   threw && threw.code === "app-shutdown/bad-phase");
 
+  threw = null;
+  try { b.appShutdown.create({ forceExitMarginMs: -1 }); } catch (e) { threw = e; }
+  check("create: bad forceExitMarginMs rejected", threw && threw.code === "app-shutdown/bad-force-exit-margin-ms");
+
   threw = null;
   var o = b.appShutdown.create({ phases: [] });
   try { o.addPhase({ name: "x" }); } catch (e) { threw = e; }
@@ -282,6 +286,65 @@ async function testAppShutdownConfigValidation() {
   o._resetForTest();
 }
 
+async function testAppShutdownWatchdogForcesExitOnHang() {
+  // A shutdown phase that never settles must NOT hold the process open
+  // until the supervisor SIGKILLs it (losing the final DB flush). When the
+  // operator delegates lifecycle via installSignalHandlers, a watchdog
+  // forces a clean exit graceMs + forceExitMarginMs after the signal so
+  // exit handlers (the DB re-encrypt) still run. Verified in a child
+  // process — the watchdog calls process.exit, which would kill the runner.
+  if (process.platform === "win32") {
+    // Node can't deliver SIGTERM to a JS handler on Windows (the OS
+    // terminates the process), so the graceful signal path the watchdog
+    // guards doesn't exist here. This defends a Linux-container SIGTERM
+    // deployment; the container smoke leg exercises it for real.
+    check("watchdog test skipped on win32 (no deliverable SIGTERM)", true);
+    return;
+  }
+  var cp = require("node:child_process");
+  var repoRoot = require("node:path").resolve(__dirname, "..", "..");
+  var script =
+    "var b = require(" + JSON.stringify(repoRoot) + ");" +
+    "b.appShutdown.create({" +
+    "  graceMs: 100, forceExitMarginMs: 150, installSignalHandlers: true," +
+    "  phases: [{ name: 'hang', run: function () { return new Promise(function () {}); } }]" +
+    "});" +
+    "setInterval(function () {}, 60000);" +     // keep the loop alive until the signal
+    "process.stdout.write('READY\\n');";
+  var child = cp.spawn(process.execPath, ["-e", script], { stdio: ["ignore", "pipe", "pipe"] });
+
+  // Single exit observer + bounded waits so a misbehaving child can never
+  // hang the test (it fails loudly via waitUntil's timeout instead).
+  var sentAt = null;
+  var exited = null;
+  var stderr = "";
+  child.stderr.on("data", function (d) { stderr += d.toString(); });
+  child.on("exit", function (code, signal) {
+    exited = { code: code, signal: signal, ms: sentAt === null ? 0 : Date.now() - sentAt };
+  });
+
+  var sawReady = false;
+  child.stdout.on("data", function (d) { if (d.toString().indexOf("READY") !== -1) sawReady = true; });
+  try {
+    await helpers.waitUntil(function () { return sawReady || exited !== null; },
+      { timeoutMs: 6000, label: "app-shutdown watchdog: child reached READY" });
+  } catch (_e) { /* fall through to the check below */ }
+  check("watchdog child reached READY (stderr: " + stderr.slice(0, 160).replace(/\n/g, " ") + ")",
+        sawReady && exited === null);
+  if (!sawReady || exited !== null) { try { child.kill("SIGKILL"); } catch (_e2) { /* gone */ } return; }
+
+  sentAt = Date.now();
+  child.kill("SIGTERM");
+  // The watchdog fires at graceMs(100) + forceExitMarginMs(150) = 250ms.
+  await helpers.waitUntil(function () { return exited !== null; },
+    { timeoutMs: 6000, label: "app-shutdown watchdog: child forced exit after SIGTERM" });
+  // It EXITS (not hangs) and does so on its own — a forced process.exit
+  // (numeric code, no kill signal), not because the OS killed it.
+  check("hung shutdown forced to exit by watchdog (not hung)", exited && exited.ms < 4000);
+  check("watchdog exit was a clean process.exit (not a kill signal)",
+        exited && exited.signal === null && typeof exited.code === "number");
+}
+
 async function run() {
   testAppShutdownSurface();
   await testAppShutdownEmpty();
@@ -299,6 +362,7 @@ async function run() {
   await testAppShutdownStandardPhasesOmitsAbsentComponents();
   await testAppShutdownSignalHandlersInstall();
   await testAppShutdownConfigValidation();
+  await testAppShutdownWatchdogForcesExitOnHang();
 }
 
 module.exports = { run: run };

package/lib/vendor/blamejs/test/layer-0-primitives/bounded-map.test.js

@@ -0,0 +1,87 @@
+"use strict";
+/**
+ * bounded-map — entry-count-capped Map facade.
+ *
+ * Run standalone: `node test/layer-0-primitives/bounded-map.test.js`
+ * Or via smoke:   `node test/smoke.js`
+ */
+
+var helpers = require("../helpers");
+var check   = helpers.check;
+var { boundedMap, BoundedMapError } = require("../../lib/bounded-map");
+
+function testEvictOldest() {
+  var evicted = [];
+  var m = boundedMap({ maxEntries: 3, onEvict: function (k, v) { evicted.push(k + "=" + v); } });
+  m.set("a", 1); m.set("b", 2); m.set("c", 3);
+  check("evict-oldest: at capacity, all present", m.size === 3 && m.has("a") && m.has("c"));
+  m.set("d", 4);
+  check("evict-oldest: size stays at cap",        m.size === 3);
+  check("evict-oldest: oldest (a) evicted",       !m.has("a") && m.has("d"));
+  m.set("e", 5);
+  check("evict-oldest: next oldest (b) evicted",  !m.has("b") && m.has("e"));
+  check("evict-oldest: onEvict fired for a,b",    evicted.join(",") === "a=1,b=2");
+}
+
+function testUpdateDoesNotGrowOrEvict() {
+  var evicted = [];
+  var m = boundedMap({ maxEntries: 2, onEvict: function (k) { evicted.push(k); } });
+  m.set("x", 1); m.set("y", 1);
+  var r = m.set("x", 99);   // update existing — must not evict y
+  check("update returns true",            r === true);
+  check("update keeps size at 2",         m.size === 2);
+  check("update did not evict",            m.has("y") && evicted.length === 0);
+  check("update changed the value",        m.get("x") === 99);
+}
+
+function testRejectPolicy() {
+  var m = boundedMap({ maxEntries: 2, policy: "reject" });
+  check("reject: first two stored",       m.set("a", 1) === true && m.set("b", 1) === true);
+  check("reject: third refused",          m.set("c", 1) === false);
+  check("reject: new key NOT stored",     !m.has("c") && m.size === 2);
+  check("reject: live entries untouched", m.has("a") && m.has("b"));
+  // Updating an existing key is still allowed at capacity (no growth).
+  check("reject: update existing allowed", m.set("a", 2) === true && m.get("a") === 2);
+}
+
+function testMapFacade() {
+  var m = boundedMap({ maxEntries: 10 });
+  m.set("k1", "v1"); m.set("k2", "v2");
+  check("get",    m.get("k1") === "v1");
+  check("has",    m.has("k2") && !m.has("nope"));
+  check("delete", m.delete("k1") === true && !m.has("k1") && m.size === 1);
+  var iter = [];
+  for (var e of m) iter.push(e[0] + "=" + e[1]);
+  check("iterable yields entries", iter.join(",") === "k2=v2");
+  var keys = []; var it = m.keys(); var n; while (!(n = it.next()).done) keys.push(n.value);
+  check("keys()", keys.join(",") === "k2");
+  var fe = []; m.forEach(function (v, k) { fe.push(k + "=" + v); });
+  check("forEach", fe.join(",") === "k2=v2");
+  m.clear();
+  check("clear", m.size === 0);
+}
+
+function testValidation() {
+  function threw(fn) { try { fn(); return null; } catch (e) { return e; } }
+  check("maxEntries 0 → throws",     threw(function () { boundedMap({ maxEntries: 0 }); }) instanceof BoundedMapError);
+  check("maxEntries -1 → throws",    threw(function () { boundedMap({ maxEntries: -1 }); }));
+  check("maxEntries 1.5 → throws",   threw(function () { boundedMap({ maxEntries: 1.5 }); }));
+  check("maxEntries missing → throws", threw(function () { boundedMap({}); }));
+  var e = threw(function () { boundedMap({ maxEntries: 5, policy: "nope" }); });
+  check("bad policy → throws bad-policy", e && e.code === "bounded-map/bad-policy");
+}
+
+function run() {
+  testEvictOldest();
+  testUpdateDoesNotGrowOrEvict();
+  testRejectPolicy();
+  testMapFacade();
+  testValidation();
+}
+
+module.exports = { run: run };
+
+if (require.main === module) {
+  try { run(); console.log("[bounded-map] OK — " + helpers.getChecks() + " checks passed"); }
+  catch (e) { console.error("FAIL:", e.stack || e); process.exit(1); }
+}

package/lib/vendor/blamejs/test/layer-0-primitives/cache.test.js

@@ -639,6 +639,52 @@ function _newCache(extra) {
   return b.cache.create(Object.assign({ namespace: "v411", backend: "memory" }, extra || {}));
 }
 
+async function testUpdateMemory() {
+  var c = _newCache({ namespace: "upd-mem" });
+  var r1 = await c.update("n", function (cur) { return { value: (cur || 0) + 1 }; });
+  await c.update("n", function (cur) { return { value: cur + 1 }; });
+  check("update memory: increments atomically", (await c.get("n")) === 2 && r1.value === 1);
+  var ab = await c.update("n", function () { return { abort: { why: "nope" } }; });
+  check("update memory: abort leaves value + returns aborted",
+        ab.aborted && ab.aborted.why === "nope" && (await c.get("n")) === 2);
+  var dl = await c.update("n", function () { return { delete: true }; });
+  check("update memory: delete removes the entry",
+        dl.deleted === true && (await c.get("n")) === undefined);
+  // update on an absent key sees null and may create.
+  var cr = await c.update("fresh", function (cur) { return { value: cur === null ? "created" : "x" }; });
+  check("update memory: absent key seen as null", cr.value === "created" && (await c.get("fresh")) === "created");
+  await c.close();
+}
+
+async function testUpdateClusterCas() {
+  var tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "blamejs-cache-upd-"));
+  try {
+    await setupTestDb(tmpDir);
+    var c = b.cache.create({ namespace: "upd-clu", backend: "cluster", ttlMs: b.constants.TIME.minutes(5) });
+    await c.update("set", function (cur) { return { value: { items: (cur ? cur.items : []).concat("a") } }; });
+    await c.update("set", function (cur) { return { value: { items: cur.items.concat("b") } }; });
+    // Concurrent appends: the compare-and-set + retry must preserve BOTH
+    // (no lost update) — the cluster race the get/set version dropped.
+    await Promise.all([
+      c.update("set", function (cur) { return { value: { items: cur.items.concat("x") } }; }),
+      c.update("set", function (cur) { return { value: { items: cur.items.concat("y") } }; }),
+    ]);
+    var fin = await c.get("set");
+    check("update cluster: concurrent CAS loses no write", fin.items.length === 4);
+    check("update cluster: all appends present",
+          fin.items.indexOf("a") !== -1 && fin.items.indexOf("b") !== -1 &&
+          fin.items.indexOf("x") !== -1 && fin.items.indexOf("y") !== -1);
+    var ab = await c.update("set", function () { return { abort: { stop: 1 } }; });
+    check("update cluster: abort returns aborted + leaves value",
+          ab.aborted && ab.aborted.stop === 1 && (await c.get("set")).items.length === 4);
+    await c.update("set", function () { return { delete: true }; });
+    check("update cluster: delete removes the entry", (await c.get("set")) === undefined);
+    await c.close();
+  } finally {
+    await teardownTestDb(tmpDir);
+  }
+}
+
 async function testMaxBytesEvictsLru() {
   // Cache size budget: 30 bytes. Each entry ~12 bytes JSON ("aaaaaaaa" → 10).
   var c = _newCache({
@@ -847,6 +893,8 @@ async function run() {
   await testClusterBackendBasics();
   await testClusterNamespaceIsolation();
   await testClusterTtlExpiration();
+  await testUpdateMemory();
+  await testUpdateClusterCas();
 
   // v0.4.11
   await testValidationNewOpts();